EEVblog #682 - Ness D16X Alarm Panel Repair

[EEVblog]

Part teardown, part repair, Dave looks at an Australian designed and manufactured Ness D16X alarm panel that has failed.
What's that smell?
Can it be fixed?
How do you repair solder mask on a PCB?, or add solder mask to your own home etched PCB's?
And another look at PCB spark gaps.

Datasheets:
Fairchild F8
http://en.wikipedia.org/wiki/Fairchild_F8
Holtek DTMF Receiver
http://www.holtek.com/english/docum/comm/9170.htm
Maxcap Capacitors:
http://www.maxcap.com.my/guideline.html
Epcos MOVs
http://www.epcos.com/inf/70/db/var_11/SIOV_Leaded_StandarD.pdf

[moemoe]

Here is your Temp Rating: 85°C

[EEVblog]

Here is your Temp Rating: 85°C

Ah, missed that on the camcorder monitor.

[mux]

Why did you need to repair this one? Where was it from? Who used it?

[skyline_stu]

I've used that same solder mask-it really needs to be a thin layer as you've suggested.

I think the micro's a Fujitsu H8-538 rather than a Fairchild device.. 

And on the phone line it's more likely a gas discharge arrestor. 

[German_EE]

Cut traces to isolate the damaged area and then build a small daughter board to hold everything from the input MOVs to the bridge rectifier. The hole in the PCB can be repaired with epoxy to prevent any more carbonized PCB escaping. I suspect that the single trace from the AC input is to monitor the mains supply, drive a 'mains fail' LED and switch over to battery power.

[free_electron]

Thats not a fair hild cpu but a Fujitsu ...

[Fungus]

Dremel out the middle bit. Couple of wires from the PTCs to the rectifier...job done!

 

[SeanB]

Lost mains neutral in the supply system, and was exposed to 300VAC or more as it was the low current phase. Transformed to around 25V and this cooked the Transorb that was across the 17VAC rail.

The 7805 is the battery charge circuit, used with the ground lifted 9V1 by a pair of resistors to charge the battery with 13.8V, relying on the 7805 current limiting and overheat protection to protect the battery. The junction of the resistors to the 7805 ground pin is connected to the collector of a transistor, which is turned on every 15 minutes to turn the charger circuit off via the reverse blocking diode, so the MCU can read the battery voltage using a voltage divider on the board connected to an input of a multiplexer feeding the internal ADC. This is used to detect a failing battery so it will show a failure on the panel, and not fail silently with power off.

The keyboard link allows you to connect both multiple keypads and input extenders, so that you can have more than 16 inputs ( up to 48/64 inputs most likely with 2 extra expanders) on the same control panel. Lots you can do as well, like partition it. or you have certain inputs connected to fire alarms which operate 24 hours, and cannot be bypassed, or you can use it as a UL listed fire alarm.

[djQUAN]

Hi Dave,

Was thinking of sending you an email again but decided to join the forum instead, so here's my first post here. Please be nice to me

I just saw your vid on the repair and would like to comment on a few things

As per some comments, the uC is a Fujitsu brand. It has a different "F" than fairchild. A google image search confirmed this

The part is an MB89F538 (http://www.alldatasheet.com/datasheet-pdf/pdf/153408/FUJITSU/MB89F538-201PV.html) 8bit uC.

Also, the part that has burned is most probably a ceramic capacitor for EMC/EMI. You have the two caps from each line to ground and then a third across the AC input.

In my previous work, for fire hazard reasons, we use two ceramic capacitors in series to prevent a direct short across the supply line causing a fire. With two in series, if one fails, the other will work fine no problem in the application.

What I think happened here could be that the cap experienced a voltage spike across the lines or that it is cracked in the first place after thermal cycling or board flexing causing an internal short which resulted to a direct short on the AC input line then causing the cap to burst into flames. (Yes, I have caused the same type of flame on a project when I subjected an axial MLCC with voltage spikes.)

Also, with regards to the MOV not being populated in the daughter board, we used to design everything into the PCB and populate everything in the initial design. After testing, we remove parts to save cost and check the performance if it still meets the requirements. If it still does, then we leave the part off in the next revisions up to the mass production stage.

-Raymond

[stitch]

The lettering on the PCB suggests that the designers intended the alarm to be oriented opposite of what Dave thinks it should have been.  If so, then the black residue isn't airborne soot at all, but rather downward flowing melt from maybe the case of the failed device.  Maybe in such an orientation, the heat stovepiped up the heat sink, produced that "bit of charring on the cap", and overheated the device that failed.

[SeanB]

Every alarm panel I have seen has the wiring at the bottom, with the board mounted right at the top of the case so you can fit the 12V 7.2Ah battery in the bottom, with all the wiring going to the cable exit in a mass of spaghetti with all colours. No other way, as you really want that battery at the bottom so when it does pop the gunk runs down and not across the board.

[Switching Power]

Maybe i have it wrong but when the input voltage gets above 70V RMS the two MOVs to ground are basically in series and would absorb any spikes above 70V.

[gardner]

How many layers in that board?  Is there a short in the internal layers?
You never showed us the back of that section.  What's it look like?

EDIT -- there is a quick look at the back at 03:00 or so, and a frame or two without Dave's hand in the way.

I was trying to see what J4 is about -- it looks like connecting the system ground to mains earth or leaving it isolated -- as here.

[SeanB]

Maybe i have it wrong but when the input voltage gets above 70V RMS the two MOVs to ground are basically in series and would absorb any spikes above 70V.

True, but I would bet that MOV across the rails is going to be a 25VAC part, as the main capacitor is a 30V part, so it will definitely blow apart at 70VAC input. 25VAC part will start to clamp hard at around 30VAC, and this will give around 40VDC across the capacitor. Not optimal for long life, but most capacitors will withstand a 30% overvoltage for a few minutes ( solid tantalum being the exception, along with OSCON as well) without going bang. You often see a capacitor with a rating of say 35VDC with a surge voltage of 42V permissible. Most might withstand a 50% overvoltage for 10 minutes ( way longer than the time it should take the mains fuse to fail from the moderate overcurrent from the transient suppressor) with no ill effect, and possibly a few will show visible signs of bulging, or a blown safety vent.

The MOV devices to ground are there for lightning protection, along with the dual gas discharge tube on the telephone line side. Very common for high voltages to be induced onto phone lines and onto power lines, and to couple through the house wiring. The MOV's and GDT units are there to clamp this to a safe level, and couple the overvoltage to ground ( the installation also recommends a short high current lead to a grounded metal structure in a building, or to a dedicated ground rod outside or a copper or steel water pipe, to reduce impedance of this earth lead) safely. The spark gaps handle the internal iring spikes, note that the resistors used there on the inputs are not low voltage SMD devices but MELF packages that have a higher voltage rating and better surge capability.

As the alarm will have to be directly on the incoming phone line ( it has to be the first device so the relay can pull in to disconnect the inside wiring from the line to seize it under any circumstance) it will be exposed to all incoming spikes.

[sunnyhighway]

How many layers in that board?  Is there a short in the internal layers?
You never showed us the back of that section.  What's it look like?

EDIT -- there is a quick look at the back at 03:00 or so, and a frame or two without Dave's hand in the way.

I was trying to see what J4 is about -- it looks like connecting the system ground to mains earth or leaving it isolated -- as here.

Full bottom vieuw:
Close-up:

[electronic_eel]

Also, the part that has burned is most probably a ceramic capacitor for EMC/EMI. You have the two caps from each line to ground and then a third across the AC input.

That would be my guess too.

I have seen several MLCCs that went from ok to explosion or big flame after a year or two of use. I guess they crack through thermal stress, flexing of the board or improper solder profile during production.

The crack is not a dead short but low ohmic, so the power supply doesn't shut off but continues to deliver power, heating up the cap more and more till the flames come out.

The solution is either a very strict and tight current limit (e.g. an electronic fuse) or using two caps in series as Raymond suggested.

[Yansi]

Have not seen the whole video yet (still watching), but Dave, you sure the two blue things are MOVs?  In the silk there is Y10, Y11.. common way to mark Y series safety capacitors (Y1 or Y2 - 2 to 4 kV rated, I don't rember the exact value).  Or have you read and decoded the part number?

//EDIT: Meh, really MOVs !  O0

But hey, thank you for some good video, about electronics, not that awful solar stuff. I look forwar for the next video!

[Dave Turner]

Surely in practice this wouldn't be economical to repair.

However if it must be repaired and given the depth of burn damage I'd grind out all the damaged substrate including the tracks.
Then I'd use a compatible filler to reinforce the remaining board to the same thickness as there is a mounting hole at the corner. Then I'd create a small board to bond over the repaired substrate to mount the missing components and link to the existing connections.

How would you solve the problem if the unit MUST be repaired?

[PA0PBZ]

So if you mix charred pcb with liquid soldermask it turns low R 

[moemoe]

Surely in practice this wouldn't be economical to repair.

Not only this, here (germany) it would surely loose it's VdS approval and therefore your insurance could refuse to pay.

[Vito_R]

Ness is calling those small light bulbs "Current Limiting Globes" actually a cheap way they decided to go to regulate the battery charge current instead of designing a separate circuit.  The installation manual describes how it works:

Current Limiting Globes
The current limiting globes serve to regulate battery charging current.
When the battery is fully charged the globes will not glow. The
globes will glow slightly when recharging the battery after a short
power outage. If the globes glow very brightly the battery is drawing
excessive current and may be faulty, or the battery is connected in
reverse.

[ludzinc]

Lost mains neutral in the supply system, and was exposed to 300VAC or more as it was the low current phase. Transformed to around 25V and this cooked the Transorb that was across the 17VAC rail.

The 7805 is the battery charge circuit, used with the ground lifted 9V1 by a pair of resistors to charge the battery with 13.8V, relying on the 7805 current limiting and overheat protection to protect the battery. The junction of the resistors to the 7805 ground pin is connected to the collector of a transistor, which is turned on every 15 minutes to turn the charger circuit off via the reverse blocking diode, so the MCU can read the battery voltage using a voltage divider on the board connected to an input of a multiplexer feeding the internal ADC. This is used to detect a failing battery so it will show a failure on the panel, and not fail silently with power off.

The keyboard link allows you to connect both multiple keypads and input extenders, so that you can have more than 16 inputs ( up to 48/64 inputs most likely with 2 extra expanders) on the same control panel. Lots you can do as well, like partition it. or you have certain inputs connected to fire alarms which operate 24 hours, and cannot be bypassed, or you can use it as a UL listed fire alarm.

Hi SeanB

I always wondered how alarm panels did this - my panel at home is currently (intermittently) bitching about it's battery failing.  Time to swap it out.

But, you know, effort....

[EEVblog]

Surely in practice this wouldn't be economical to repair.

From a business point of view, no. From a personal point of view, it's $200 for a replacement board.

However if it must be repaired and given the depth of burn damage I'd grind out all the damaged substrate including the tracks.
Then I'd use a compatible filler to reinforce the remaining board to the same thickness as there is a mounting hole at the corner. Then I'd create a small board to bond over the repaired substrate to mount the missing components and link to the existing connections.
How would you solve the problem if the unit MUST be repaired?

A slot as I said should be enough for bodge fix.
But yeah, an entire replacement board, or dug out and refilled with epoxy etc are more professional methods.
Any way you do it it's still a bodge though.

[EEVblog]

Thanks for a viewer submitted photo, I can confirm it is an MLCC used.
Clearly it has failed short circuit and heated up enough to catch on fire! 
I think this is potentially serious issue, and I have contacted Ness about it.

[adh]

The keypad interface is probably not any reasonable long reach interface, but straight TTL-level I2C or something similar. Running TTL-level (I2C or otherwise) signals across long runs of some dodgy cable seems to be quite popular in alarm systems. I had even seen board marked something like "Remote zone extender" (in the same box there was bunch of random DSC boards, but I'm not sure if this particular one was DSC-branded) that was essentially 7805+PCF8574 with pins broken out to screw terminals.

[EEVblog]

The keypad interface is probably not any reasonable long reach interface, but straight TTL-level I2C or something similar. Running TTL-level (I2C or otherwise) signals across long runs of some dodgy cable seems to be quite popular in alarm systems.

Yes, must be single ended, otherwise 4 terminals would be needed for clock and data.
Seems crazy!

[EEVblog]

I think this is potentially serious issue, and I have contacted Ness about it.

FYI, Ness responded within minutes and it has gone to R&D for investigation.

[Vito_R]

I think this is potentially serious issue, and I have contacted Ness about it.

FYI, Ness responded within minutes and it has gone to R&D for investigation.

Glad to see they are taking that issue very seriously.  I could imagine what could happen if those flames could potentially ignite other materials in the panel box.  We techs often leave wiring lists / diagrams on paper in those panel boxes for any troubleshooting needed in the future. 

[EEVblog]

Glad to see they are taking that issue very seriously.  I could imagine what could happen if those flames could potentially ignite other materials in the panel box.  We techs often leave wiring lists / diagrams on paper in those panel boxes for any troubleshooting needed in the future. 

Yes, paper is very common inside panels like this, behind the front panel only inches from the board.

[stitch]

I think this is potentially serious issue, and I have contacted Ness about it.

FYI, Ness responded within minutes and it has gone to R&D for investigation.

Glad to see they are taking that issue very seriously.  I could imagine what could happen if those flames could potentially ignite other materials in the panel box.  We techs often leave wiring lists / diagrams on paper in those panel boxes for any troubleshooting needed in the future. 

While they're at it, maybe they can change the cover photo on the D16 User Manual.
The manual has a cover photograph of the board posing in exactly the position that Dave warns against.
https://www.bensecurity.com.au/docs/D16_user_rev4.5.pdf

[djQUAN]

Also, the part that has burned is most probably a ceramic capacitor for EMC/EMI. You have the two caps from each line to ground and then a third across the AC input.

Thanks for a viewer submitted photo, I can confirm it is an MLCC used.
Clearly it has failed short circuit and heated up enough to catch on fire! 
I think this is potentially serious issue, and I have contacted Ness about it.

Do I get an award? 

[mattinx]

Just one of those odd quirks - right after Dave posts this video, one of my friends posts this link which happens to illustrate how you'd deal with the same problem affecting a slightly larger section of board: http://home.comcast.net/~rburn/PCB-rework/

[johnk]

That was an interesting video again, as always. 
Dave mentioned that the sensor inputs have to be terminated with a 2.2k resistor. I don't know if you guys think that it's wrong to post public about such ideas, but it set me thinking how such a sensor could be deactivated.   

One could try to remove the isolation of the two sensor wires with a knife (one cable just once, the other one at two spots). Then he could connect a amp-meter between the cuts on the one wire, cut the wire between and add a volt-meter between the two wires. Through the current and voltage he could calculate the resistor, that is needed to terminate the sensor input.

Then he could place a high-value (like 100*R) potentiometer (set to 0 Ohm) in the cut wire and remove the amp-meter. Also he would have to add a potentiometer in series with a resistor of the calculated value between the two wires (parallel to the sensor-input connections), while the potentiometer has, again, a high value and is set to max. R this time.

Then the potentiometers could be adjusted - keeping an eye on the voltmeter - so that at the end the sensor is completely isolated and instead of it a resistor terminates the sensor input connections.

PS: He could of course also be she 

[SeanB]

The resistor values are commonly known, just you can either use a 3k3 resistor for a single zone, or use a pair of resistors if you are splitting zones ( which is a pain to troubleshoot) of 3.74k and 6.98k. From the outside you do not know which system has been selected for the install, and if you get it wrong the alarm will activate. The window on the comparator in the MCU is very small.

http://www.interlogix.com/_/assets/library/I-NX8E-IM%20Rev%20C%20Installation%20Manual.pdf

Install an resistor values are page 8.

Common in alarm systems to make sure the wiring is not accessible in any case, and often the installers are lazy and install the resistors in the panel, as opposed to the correct method of putting them in the actual sensors.

[Rasz]

Surely in practice this wouldn't be economical to repair.

Country:UK - figures

this is 10-30 minutes of work, either cut it out or bypass

here on 12 layer board
? ? ?? ?? ?! ?? 2.

[Monkeh]

Surely in practice this wouldn't be economical to repair.

Country:UK - figures

this is 10-30 minutes of work, either cut it out or bypass

here on 12 layer board
? ? ?? ?? ?! ?? 2.

Blindly attacking a PCB with a Dremel he can't keep control of. Country: Russia. Figures.

[EvilGeniusSkis]

Dave, you forgot the links to this thread In the youtube description and on the eevblog.com post. also for repair I'd make up a daughter board and completely bypass the burned section. Maybe see if Ness will swing a replacement board your way for reporting a potentially life-threatening problem. (the board looks like the cost comes from low production volumes)

[Agent24]

So if you mix charred pcb with liquid soldermask it turns low R 

That was my thought also.

[Yago]

Surely in practice this wouldn't be economical to repair.

However if it must be repaired and given the depth of burn damage I'd grind out all the damaged substrate including the tracks.
Then I'd use a compatible filler to reinforce the remaining board to the same thickness as there is a mounting hole at the corner. Then I'd create a small board to bond over the repaired substrate to mount the missing components and link to the existing connections.

How would you solve the problem if the unit MUST be repaired?

Hi Dave
Had a similar idea and never tried:
I considered, etching and drilling the section from suitable clad board and grafting into the damaged board.
Bond with the correct epoxy, chamfer the edges of "hole" and "graft" to key to each other, perhaps re-enforce with glass tape.

Or possibly re-lay grp straight on the board to repair (obviously need releasable former).

Never did try, and really am unaware of the correct materials.

[TheBay]

You guys should use Ademco/Honeywell galaxy over in Aus

[Vito_R]

You guys should use Ademco/Honeywell galaxy over in Aus

I agree, I've been using those Ademco(now bought by Honeywell) panels for over 20 years and they are rock solid reliable.

[EEVblog]

FYI, I've been invited to Ness next Tuesday. Will hopefully get some video.

[EvilGeniusSkis]

FYI, I've been invited to Ness next Tuesday. Will hopefully get some video.

they might even give you a new board for free

[Yago]

Missed those vids on PCB repair earlier, doh!

Why did the Russian guy cut the PCB? (no it's not a lead-in for a two line gag!)

[TeaNTronics]

hey, check this out:
http://hackaday.com/2014/11/13/extreme-repair-of-a-burnt-pcb/
there is a guy there who made extreme repair to his amplifier board of his JBL L8400P subwoofer,
he had a hole in the board due to electrolyte released from caps, etching hole in the board.



and btw in the end they mention dave's Ness D16X fix

[German_EE]

That is an impressive piece of work.

[sunnyhighway]

That was an interesting video again, as always. 
Dave mentioned that the sensor inputs have to be terminated with a 2.2k resistor. I don't know if you guys think that it's wrong to post public about such ideas, but it set me thinking how such a sensor could be deactivated.   

One could try to remove the isolation of the two sensor wires with a knife (one cable just once, the other one at two spots). Then he could connect a amp-meter between the cuts on the one wire, cut the wire between and add a volt-meter between the two wires. Through the current and voltage he could calculate the resistor, that is needed to terminate the sensor input.

Then he could place a high-value (like 100*R) potentiometer (set to 0 Ohm) in the cut wire and remove the amp-meter. Also he would have to add a potentiometer in series with a resistor of the calculated value between the two wires (parallel to the sensor-input connections), while the potentiometer has, again, a high value and is set to max. R this time.

Then the potentiometers could be adjusted - keeping an eye on the voltmeter - so that at the end the sensor is completely isolated and instead of it a resistor terminates the sensor input connections.

PS: He could of course also be she 

Good thinking, but don't quit your day-job.
You would have been detected by one of the sensors before you can even touch one of the cables, because they are all inside the secured area.

[VK3DRB]

It looks like a TVS was the device in the board. Incidentally, heat does NOT rise in a heatsink- it travels in all directions without concern to orientation. There is a slight effect from heat rising in the air around it, and yes having the cap below it is better than above.

A mate opened a TV repair shop some years ago. I used to drop around Thursday night to help with the difficult bugs, getting paid in non-taxable beer and pizza. It was a lot of fun. One day someone dropped a colour TV around because he had thrown it at his house mate in a fit of rage. I was going to try to fix it the following week. The following Thursday I dropped in and my mate said don't worry - the owner's house mate had murdered the TV set owner. We left the TV for a while in case it was going to used as evidence. In the end I tried to fix it, but I threw it out... the entire main PCB had broken in two and there were too many tracks to try to repair. Some things just cannot be fixed.

[electronic_eel]

Dave mentioned that the sensor inputs have to be terminated with a 2.2k resistor. I don't know if you guys think that it's wrong to post public about such ideas, but it set me thinking how such a sensor could be deactivated.   
[...]

Good thinking, but don't quit your day-job.
You would have been detected by one of the sensors before you can even touch one of the cables, because they are all inside the secured area.

Let's say you are able to sneak an articulated arm or similar into the secured area and to the alarm cables.

How would it help to know the values of the resistors? The comparator in the alarm system will react to resistance changes within microseconds or at least milliseconds.

You won't be able to cut the cable and place a resistor between the wires in that time. And you can't pierce the wire and place a resistor in between before cutting: you'd parallel the resistors which is easily detectable by the comparator.

[EEVblog]

It looks like a TVS was the device in the board.

No, it's just a regular MLCC capacitor.

[SeanB]

It looks like a TVS was the device in the board.

No, it's just a regular MLCC capacitor.

I thought the days of flaming ceramics was over.............

[miguelvp]

Let's say you are able to sneak an articulated arm or similar into the secured area and to the alarm cables.

How would it help to know the values of the resistors? The comparator in the alarm system will react to resistance changes within microseconds or at least milliseconds.

You won't be able to cut the cable and place a resistor between the wires in that time. And you can't pierce the wire and place a resistor in between before cutting: you'd parallel the resistors which is easily detectable by the comparator.

Even if I told you my alarm box is inside the master bedroom walking closet, is your articulated arm going to be long enough and open the closet, the panel and well many other things?

I'm pretty sure someone that robs for a living has other methods or they can just buy the panel and study it.

[SeanB]

Even if I told you my alarm box is inside the master bedroom walking closet, is your articulated arm going to be long enough and open the closet, the panel and well many other things?

I'm pretty sure someone that robs for a living has other methods or they can just buy the panel and study it.

Is there a set of sensors in your roof space, as that is the common way to disable the alarm.

[miguelvp]

exactly, that's why an articulated arm makes no sense at all, they just need access to the box, once there a resistor value being posted in here is not going to make a difference

Edit: but johnk has a point because the resistor value is at the sensor level, I guess I missed that, there go all my valuables.

[stitch]

Incidentally, heat does NOT rise in a heatsink- it travels in all directions without concern to orientation. There is a slight effect from heat rising in the air around it, and yes having the cap below it is better than above.

Yes, that's the idea, but this heat sink was shaped like a chimney and the 7805 was not firmly connected to it - no heat sink compound.
So the heat sink could be acting more like a chimney than a heat sink.

[Teemo]

So it was the ceramic cap...  In my experience in production I have seen it to be quite common for a supply decoupling MLCCs to fail on some products. Usually it was good short under a Ohm but sometimes it was up to 100 Ohms. Not exactly sure why it happened, my best guess is that those caps do not like large current spike when initially charging up, or current spike when shorting the charged cap.

[johnwa]

Let's say you are able to sneak an articulated arm or similar into the secured area and to the alarm cables.

How would it help to know the values of the resistors? The comparator in the alarm system will react to resistance changes within microseconds or at least milliseconds.

You won't be able to cut the cable and place a resistor between the wires in that time. And you can't pierce the wire and place a resistor in between before cutting: you'd parallel the resistors which is easily detectable by the comparator.

OK, let's assume that physical access to the wiring is possible, and that the alarm panel is sensing DC voltage levels. (Dave did mention multiplexing, but this should not be a problem provided it does not occur too quickly). Now, strip a length of one of the conductors, solder a small value resistor across, and then cut the wire bypassing the resistor. The resistor value is chosen to be small enough that it doesn't disturb the loop enough to trigger the alarm. (The end-of-line resistors will be 1% tolerance at best, so there should be some margin available).

The resistor can be used to sense the current flowing in the loop. This can be amplified with an op-amp, and imposed across the lines, effectively creating a synthetic resistor equal in value to the EOL resistor.

With the loop intact, the op-amp will not provide any output current. But as soon as the loop is cut, the op-amp will instantly take up the current that was flowing through the resistor. Provided that the system is fast enough, the alarm panel will not notice the difference. (The sensing circuit cannot be too quick to raise the alarm, otherwise it would be vulnerable to EMI)

Though, I expect anyone who could make this work has better things to be doing than breaking into houses...